CVE-2018-17537: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

PT-2023-10701

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.0 through 11.1.7 GitLab Community and Enterprise Edition versions 11.2.0 through 11.2.4 GitLab Community and Enterprise Edition versions 11.3.0 through 11.3.1 Description The issue is relat...

CVE-2018-17450

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery SSRF via the Kubernetes integration, leading for example to disclosure of a GCP service token...

PT-2023-11342

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.11.8 and earlier GitLab Community and Enterprise Edition versions 12.0.6 and earlier GitLab Community and Enterprise Edition versions 12.1.6 and earlier Description An issue was discovered in...

CVE-2018-17452

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery SSRF via a loopback address to the validatelocalhost function in urlblocker.rb...

CVE-2019-13009

An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control...

CVE-2019-13007

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption...

CVE-2019-13006

An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control...

CVE-2019-13004

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control issue 1 of 2...

CVE-2019-13002

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control...

CVE-2019-12446

An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message...

CVE-2019-12445

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS...

CVE-2019-12441

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control...

CVE-2019-12434

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...

CVE-2019-12432

An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure...

PT-2020-9319

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7 through 11.11 Description: The issue is related to improper input validation, allowing the creation of internal projects in private groups with restricted visibility settings. This leads t...

PT-2020-9324

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 10.2 through 11.11 Description: An issue was discovered in multiple features, causing Server-Side Request Forgery SSRF vulnerabilities due to insufficient validation to prevent DNS rebinding...

PT-2020-9357

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.10 through 12.0.2 Description: An issue was discovered that allows unauthorized users to read pipeline information of the last merge request due to Incorrect Access Control. Recommendations:...

PT-2020-9320

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 10.6 through 11.11 Description: An issue allows users to guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments, leading to Information...

PT-2020-9315

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.9 through 11.11 Description: An issue was discovered that allows unprivileged users to access labels, status, and merge request counts of confidential issues via the milestone details page...